A SEO Analysis tool is showing cookie and token information publicly after fetching it from my website.
Is having this information from whithin my site's HTTP header published publicly safe? If it's not, how do I hide this from public view?
Is showing cookie and token information publicly from within the HTTP header safe...
If the data is sensitive, then no.
Visit https://redbot.org/ and enter the URL of the page that sends the headers (that you are concerned about) to the browser. and you'll see them on that site.
...how do I hide this from public view?
Depends on what public means.
If it means clients who know nothing about technology, then good job!
If it means anyone or anything that scrapes whatever data they can get from a URL (such as crawlers), then your best bet is to encrypt at least the value of the header.
A header containing:
is far better than:
If you're page is generated from PHP, then consider using PHP sessions because it encodes your cookie values for you when passing values via HTTP.
If you're setting cookies manually, then at least encode the values if you want security.